PatchTheCVEzzzcms vulnerabilities
Recent CVEs affecting zzzcms products. 20 tracked.
zzzcms has 20 tracked vulnerabilities, 9 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 3. Most recent: 2023-10-25. Highest priority: CVE-2019-9082 (score 86/100).
- CVE-2023-5582 LOW 3.5 DOWNGRADE A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0
- CVE-2023-5263 MEDIUM 6.3 DOWNGRADE A vulnerability was found in ZZZCMS 2.1.7 and classified as critical
- CVE-2023-45909 MEDIUM 6.1 DOWNGRADE zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.
- CVE-2023-45555 HIGH 7.8 DOWNGRADE File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted f
- CVE-2023-45554 CRITICAL 9.8 DOWNGRADE File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modificatio
- CVE-2022-23881 CRITICAL 9.8 DOWNGRADE ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key()
- CVE-2021-32605 CRITICAL 9.8 UPGRADE zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the key
- CVE-2020-24877 CRITICAL 9.8 DOWNGRADE A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible a
- CVE-2020-20298 CRITICAL 9.8 DOWNGRADE Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzz
- CVE-2020-19683 MEDIUM 5.4 DOWNGRADE A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.
- CVE-2020-19682 HIGH 8.8 DOWNGRADE A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.ph
- CVE-2020-18717 CRITICAL 9.8 DOWNGRADE SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parame
- CVE-2019-9182 HIGH 8.8 DOWNGRADE There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request
- CVE-2019-9082 HIGH 8.8 EXPLOITED UPGRADE DOWNGRADE ThinkPHP Remote Code Execution Vulnerability
- CVE-2019-9041 HIGH 7.2 DOWNGRADE An issue was discovered in ZZZCMS zzzphp V1.6.1
- CVE-2019-17408 CRITICAL 9.8 DOWNGRADE parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code
- CVE-2019-16722 CRITICAL 9.8 DOWNGRADE ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru byp
- CVE-2019-16720 HIGH 7.5 DOWNGRADE ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=new
- CVE-2019-10647 CRITICAL 9.8 DOWNGRADE ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/uedit
- CVE-2018-20127 HIGH 7.5 DOWNGRADE An issue was discovered in zzzphp cms 1.5.8
FAQ
How do I fix zzzcms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zzzcms being exploited right now?
Yes: 1 zzzcms CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which zzzcms CVE should I patch first?
CVE-2019-9082 currently ranks highest (86/100): ThinkPHP Remote Code Execution Vulnerability.